Permission Management Module
This module implements the IPermissionStore
to store and manage permissions values in a database.
This document covers only the permission management module which persists permission values to a database. See the Authorization document to understand the authorization and permission systems.
How to Install
This module comes as pre-installed (as NuGet/NPM packages). You can continue to use it as package and get updates easily, or you can include its source code into your solution (see get-source
CLI command) to develop your custom module.
The Source Code
The source code of this module can be accessed here. The source code is licensed with MIT, so you can freely use and customize it.
User Interface
Permission Management Dialog
Permission management module provides a reusable dialog to manage permissions related to an object. For example, the Identity Module uses it to manage permissions of users and roles. The following image shows Identity Module's Role Management page:
When you click Actions -> Permissions for a role, the permission management dialog is opened. An example screenshot from this dialog:
In this dialog, you can grant permissions for the selected role. The tabs in the left side represents main permission groups and the right side contains the permissions defined in the selected group.
IPermissionManager
IPermissionManager
is the main service provided by this module. It is used to read and change the permission values. IPermissionManager
is typically used by the Permission Management Dialog. However, you can inject it if you need to set a permission value.
If you just want to read/check permission values for the current user, use the
IAuthorizationService
or the[Authorize]
attribute as explained in the Authorization document.
Example: Grant permissions to roles and users using the IPermissionManager
service
public class MyService : ITransientDependency
{
private readonly IPermissionManager _permissionManager;
public MyService(IPermissionManager permissionManager)
{
_permissionManager = permissionManager;
}
public async Task GrantRolePermissionDemoAsync(
string roleName, string permission)
{
await _permissionManager
.SetForRoleAsync(roleName, permission, true);
}
public async Task GrantUserPermissionDemoAsync(
Guid userId, string roleName, string permission)
{
await _permissionManager
.SetForUserAsync(userId, permission, true);
}
}
Permission Management Providers
Permission Management Module is extensible, just like the permission system. You can extend it by defining permission management providers.
Identity Module defines the following permission management providers:
UserPermissionManagementProvider
: Manages user-based permissions.RolePermissionManagementProvider
: Manages role-based permissions.
IPermissionManager
uses these providers when you get/set permissions. You can define your own provider by implementing the IPermissionManagementProvider
or inheriting from the PermissionManagementProvider
base class.
Example:
public class CustomPermissionManagementProvider : PermissionManagementProvider
{
public override string Name => "Custom";
public CustomPermissionManagementProvider(
IPermissionGrantRepository permissionGrantRepository,
IGuidGenerator guidGenerator,
ICurrentTenant currentTenant)
: base(
permissionGrantRepository,
guidGenerator,
currentTenant)
{
}
}
PermissionManagementProvider
base class makes the default implementation (using the IPermissionGrantRepository
) for you. You can override base methods as you need. Every provider must have a unique name, which is Custom
in this example (keep it short since it is saved to database for each permission value record).
Once you create your provider class, you should register it using the PermissionManagementOptions
options class:
Configure<PermissionManagementOptions>(options =>
{
options.ManagementProviders.Add<CustomPermissionManagementProvider>();
});
The order of the providers are important. Providers are executed in the reverse order. That means the CustomPermissionManagementProvider
is executed first for this example. You can insert your provider in any order in the Providers
list.